Attorney Docket No: 0016.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 1/6 



SUBNET2 




CONTROL PIANE116 



AHACK DETECTION ^ 

SYSTEM 112 



NETWORK MODELER 110 



115 



FIG.1 



Attorney Docket No: 0016.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 2/6 




Attorney Docket No: 0016.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 3/6 



CAPTURE PACKET 



COMPARE SOURCE/ 
DESTINATION TO HOME 
ADDRESS UST 



DISCARD- 


NO 


EXTERNAL 








316 






LOOK-UP SOURCE- 
OEST.-SOURCE PORT- 

DEST. PORT IN 
SIGNATURE DATABASE 



ADD SOURCE-DEST.- 
SOURCE PORT-DEST. 
PORT-PROTOCOL INTO 
SIGNATURE DATABASE 



314 



-318 




320 



FIG. 3 



Attorney Docket No: 001 6.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 4/6 



CAPTURE PACKET 



410 



REASSEMBLE PACKET 
INTO DATA STREAM 



SCAN STREAMS 



MONITOR RREWALLS 



EXTRACT PORT AND 
PROTOCOL INFORMATION 
FROM AHACK 



PASS INFORMATION TO 
CONTROL PLANE 



412 



AH 



-416 



418 



420 



FIG.4A 



Attorney Docket No: 0016.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 5/6 



CAPTURE PACKET 



COMPARE SOURCE/ 
OESTINATION TO HOME 
ADDRESS UST 



452 




UPDATE ACTIVITY 
DATABASE 



456 



DELETE INACTIVE 
DEVICES FROM ACTIVITY 
DATABASE 



COMPARE ADDRESS 
AND PORT PAIRS FROM 
EACH PROTOCOL TO 
THRESHOLD 



460 




RRST ORDER ALERT { 






RECORD FIRST ORDER 
INDICATION 






ALERT IF F 
EXCEED T 


RST ORDER 
HRESHOLD 



464 



FIG.4B 



ALERT IF EXPONENTIAL 
GROWTH 



RECORD HITS TO 
PROTOCOL 



470 



Attorney Docket No: 0016.001 1 .us 
Inventors: Thomas Henry Ptacek, et al. 
Title: Method and System for Reducing... 
Sheet 6/6 




FIG. 5 



